Individual denied access to personal information

PIPEDA Case Summary #2003-149

[Section 2; section 8(7); Principle 4.9]

Complaint

An individual complained when an organization involved in providing transportation-related services denied her access to her personal information.

Summary of Investigation

The complainant, an employee of an airport, had requested several documents, as well as an audio tape, in relation to an incident in which she was involved. The organization did not initially recognize her request as having been made under the Personal Information Protection and Electronic Documents Act, and refused. It did not provide an explanation other than stating that the requested information was not publicly available.

After the complaint was filed, and the organization recognized its error, it still refused to release the requested documents to her. Its position essentially was that an "identifier," specifically, a number, that was used to refer to the complainant in the documents was not her personal information as defined in section 2 of the Personal Information Protection and Electronic Documents Act. It also stated that if the identifier were to be deemed to be the complainant's personal information, then the information that referred to third parties in the documentation was the personal information of those individuals and could not be released without their consent. The organization agreed that the complainant's voice on the audio tape was her personal information and offered to provide her with a tape that would include only her voice, but not the voices of any of the other individuals on the tape since those voices were those individuals' personal information. It also offered to release a copy of one of the documents, without reference to any of the other individuals. The complainant declined both offers.

Commissioner's Findings

Issued April 9, 2003

Jurisdiction: As of January 1, 2001, the Personal Information Protection and Electronic Documents Act (the Act) applies to any federal work, undertaking, or business. The Commissioner had jurisdiction in this case because the organization in question is a federal work, undertaking, or business.

Application: Section 2 defines personal information as information about an identifiable individual. Principle 4.9 states that upon request, an individual shall be informed of the existence, use, and disclosure of his or her personal information and shall be given access to that information. An individual shall be able to challenge the accuracy and completeness of the information and have it amended as appropriate. Section 8(7) stipulates that an organization that responds within the time limit and refuses a request shall inform the individual in writing of the refusal, setting out the reasons and any recourse that they may have under this Part.

The Commissioner reviewed the documentation in question and determined that the complainant, though referred to by use of an identifier, was nonetheless identifiable. Since the third parties were not named and no "identifier" (such as a number) was used to refer to them, he rejected the organization's argument that the individuals referred to in the documents were similarly identifiable. As for the audio tape, he determined that the comments made by the other individuals on the tape to the complainant were her personal information.

He thus determined that the organization had documentation in its possession that contained the complainant's personal information. As the organization had refused to provide it to the complainant, and in fact stated that it had no intention of releasing it to her, the Commissioner found the organization in contravention of Principle 4.9.

The Commissioner also noted that, in its original response, the organization had failed to provide the complainant with the reasons for its denial and to inform her that she had the right to complain to the Commissioner. He therefore found the organization in contravention of section 8(7).

The Commissioner concluded that the complaint was well-founded.

Further Considerations

The Commissioner recommended that the organization release the requested information within 30 days of receiving his letter of finding.